Laravel: XSS in Debug Page Information

Low · CVSS 3.1

### Impact When `APP_DEBUG=true`, attacker-controlled input is passed to a Tippy.js tooltip configured with `allowHTML: true`, enabling DOM-based XSS during mouse hover. ### Patches [#61381](https://github.com/laravel/framework/pull/61381)

Remediation

Upgrade laravel/framework to 12.69.0 or later. Upgrade laravel/framework to 13.30.0 or later.

Affected PHP branches

See the source advisory.

Check your site

Source: GitHub Global Security Advisories (Composer ecosystem) · retrieved 2026-10-22T10:19:14-04:00 · https://github.com/advisories/GHSA-jh5r-qr3c-85q8

← All threats